IT 巨头 ConnectWise 遭入侵：黑客利用 AI Agent 突防窥探数千家企业

对于成千上万家企业而言，这周在网络安全领域本就糟糕透顶，而在 IT 管理与远程访问巨头 ConnectWise 遭遇入侵后，情况变得更加严峻——这些企业正面临来自黑客的窥探与监视。

微软安全研究人员表示，黑客攻破了 ConnectWise 的云备份服务，窃取了用于在 ConnectWise 与其企业客户之间建立数据连接的应用程序凭据；这些企业客户此前主要依赖该云服务来备份公司数据。

通过窃取这些凭据，黑客能够伪装成合法授权用户，直接登录受害者托管在微软云端的环境，并访问其电子邮件及其他敏感文件。

据微软透露，黑客利用 AI Agent（人工智能体）以每分钟近 3,000 次尝试登录的速度，迅速入侵了大约 2,250 家组织机构。微软指出，这种极快的攻击速度让防御者“几乎没有时间进行检测和响应”。

此次大规模入侵能够如此快速，归功于 AI Agent 的使用，具体使用了 ARTEX——一款配合 AI 模型对网络防御能力进行压力测试的开源 AI 框架。该 AI 软件近期也曾被用于针对韩国金融系统的攻击事件中，当时涉及的许多系统安全性较为薄弱且缺乏多因素身份验证（MFA）。

ConnectWise 表示，目前已暂停其云备份系统的访问权限，并正在对此次安全漏洞展开调查。截至周四，该公司称正在努力恢复该服务。

The bad week for cybersecurity just got worse for thousands more companies, who were spied on by Chinese hackers following the breach of IT management and remote access giant ConnectWise.

Security researchers at Microsoft say the China state-aligned hackers broke into ConnectWise’s cloud backup service and stole application credentials that are used to establish data links between ConnectWise and its corporate customers, who rely on the cloud service to back up their company’s data.

By stealing the credentials, the hackers could log in to the customer’s Microsoft-hosted environment as if they were an authorized user and access their emails and other files.

According to Microsoft, the hackers used AI agents to rapidly hack into around 2,250 organizations at a rate of almost 3,000 attempted sign-ins per minute. Microsoft said this speed gives defenders “little time to detect and respond.”

The speed of the mass-hacks was attributed to the use of AI agents, specifically ARTEX, an open source AI framework that works with AI models to stress-test cyber defenses. The same AI software was used in a recent compromise of South Korea’s financial systems, many of which had weak security and lacked multi-factor authentication.

ConnectWise said it’s paused access to its cloud backup system and is investigating the breach. As of Thursday, the company said it was working on restoring the service.